EU MDR and IVDR Technical Files: A Complete Guide

Why Technical Files Are the Foundation

The EU MDR (Medical Device Regulation, 2017/745) and IVDR (In Vitro Diagnostic Regulation, 2017/746) replaced the prior MDD/AIMDD/IVDD framework with substantially expanded documentation requirements. The technical file is the central artifact — the structured documentation that demonstrates conformity with the General Safety and Performance Requirements (GSPR).

A complete EU MDR technical file for a Class IIb device typically runs 500-1500 pages across modules. For Class III devices and implantables, 2000+ pages is common. For IVDs of Class C and D, comparable volumes apply.

The volume is intimidating, but the structure is well-defined. Manufacturers who treat the technical file as a structured set of objects — drawn from a single source of truth, generated rather than written — produce better files in less time than those who treat each module as a bespoke document.

This guide covers MDR Annex II and Annex III structure, IVDR equivalents, GSPR checklist authoring, Notified Body engagement, and how Korean MFDS submissions can leverage EU technical file work.

EU MDR Annex II — Technical Documentation

Annex II specifies the technical documentation for marketed devices. Eight major sections:

II.1 — Device Description and Specification

• Product/trade name, generic description, intended use, indications, contraindications
• Class assignment under MDR Annex VIII rules
• Previous and similar generations (where applicable)
• Device variants
• Accessories and combination products

II.2 — Information to Be Supplied by the Manufacturer

• Labeling (per Annex I §23)
• IFU (per Annex I §23)
• Implant card (for implantable devices)
• UDI carrier and database content

II.3 — Design and Manufacturing Information

• Design and manufacturing locations
• List of suppliers and critical suppliers
• Manufacturing processes with validation references
• Design controls (per ISO 13485 §7.3)
• Software lifecycle (where applicable, per IEC 62304)

II.4 — General Safety and Performance Requirements (GSPR)

The conformity demonstration. For each applicable GSPR in Annex I, the file documents:

• Whether the GSPR applies (with justification if not)
• How conformity is demonstrated (testing, analysis, clinical evaluation, harmonized standard)
• Reference to the evidence document

The GSPR checklist is one of the most-scrutinized sections. Reviewers expect explicit per-GSPR analysis, not blanket statements.

II.5 — Benefit-Risk Analysis and Risk Management

• Risk management file per ISO 14971 (see our ISO 14971 Risk Management Integration guide)
• Benefit-risk analysis demonstrating that the risk is acceptable in view of the benefit

II.6 — Product Verification and Validation

• Pre-clinical and clinical evidence
• Performance data (analytical, clinical performance)
• Biocompatibility per ISO 10993 series
• Physical and chemical characterization
• Electrical safety per IEC 60601 series (where applicable)
• EMC per IEC 60601-1-2 (where applicable)
• Software verification and validation per IEC 62304
• Usability engineering per IEC 62366
• Cybersecurity per MDCG 2019-16 (for connected devices)

The verification and validation section is the bulk of the technical file by volume.

EU MDR Annex III — Technical Documentation on Post-Market Surveillance

Annex III specifies the PMS infrastructure documentation:

• Post-market surveillance plan
• Procedures for periodic safety update reports (PSUR — see our PSUR/PBRER guide)
• Procedures for trend reporting
• Field safety corrective action procedures
• Procedures for communication with competent authorities, notified bodies, economic operators, and users
• PMCF plan and procedures

This is the PMS-side technical file — the structural design of the post-market system, not the post-market data itself. Reviewers check whether the procedures exist and are operationally executable.

EU IVDR Annex I — General Safety and Performance Requirements (IVDR)

IVDR has its own GSPR set in Annex I, with structural similarities to MDR Annex I but distinct technical content:

• Chapter I — General requirements — design and manufacture requirements
• Chapter II — Information supplied with the device — labeling, IFU
• Chapter III — Performance characteristics — analytical performance, clinical performance, scientific validity

Chapter III is where IVDR diverges most from MDR. IVDR introduces explicit performance evaluation requirements with three pillars:

1. Scientific validity — the association of the analyte with the clinical condition
2. Analytical performance — the ability to detect or measure the analyte (accuracy, precision, specificity, sensitivity, linearity, etc.)
3. Clinical performance — the ability to yield results that correlate with the clinical condition

For high-risk IVDs (Class C and D), full performance evaluation reports are required with all three pillars documented.

EU IVDR Annex II and III — Technical Documentation

IVDR Annex II structure parallels MDR Annex II, with IVD-specific content emphases:

• Device description with analyte and intended use
• Reagent and test system description
• Performance characteristics demonstration (per Chapter III GSPRs)
• Risk management and benefit-risk
• Stability and shelf-life

Annex III covers PMS, structurally similar to MDR Annex III with IVD-specific signal types.

GSPR Checklist Authoring

The GSPR checklist is a structured table — one row per applicable GSPR with conformity demonstration. A working approach:

GSPR	Applicability	Demonstration method	Evidence reference
Annex I §1 (devices shall be safe and effective)	Yes	Overall benefit-risk analysis	RM-Report-v3 §6
Annex I §2 (risk control)	Yes	Risk management file per ISO 14971	RM-File-v3
Annex I §10.1 (chemical and physical properties)	Yes	Materials testing, biocompatibility	Bio-Report-v2, Chem-Report-v1
Annex I §10.4.1 (substances of concern)	Yes - device contains phthalates >0.1% w/w	Justification per MDCG 2019-13	Phthalate-Justification-v1
Annex I §14.1 (devices intended to interact with biological samples)	No - not applicable	Justification: device does not interact with biological samples	n/a
...	...	...	...

Common authoring errors:

• Blanket "complies with harmonized standard" without specifying how. Reviewers expect the specific section of the standard and the evidence.
• Non-applicable without justification. Marking a GSPR non-applicable requires explicit rationale, not just an empty field.
• Stale evidence references. Evidence document versions referenced in the checklist must match the current version filed.

The GSPR checklist is a living artifact — it updates when evidence updates or when standards update. A version-controlled, traceability-linked checklist (typically held in PLM with cross-references to evidence documents) is the workable architecture.

Notified Body Engagement

For Class IIa and above MDR devices, and Class B and above IVDR devices, conformity assessment requires Notified Body involvement. Engagement mechanics:

Selecting a Notified Body

Considerations:

• Designation scope — does the NB hold designation for your device class and product category?
• Capacity — current backlog, review timelines
• Domain expertise — particularly for SaMD, AI/ML, novel materials, implantables
• Industry reputation — review feedback from peer manufacturers
• Geographic presence — physical inspection capability where your manufacturing is located

Major NBs (BSI, TÜV SÜD, TÜV Rheinland, DEKRA, etc.) have different specialization profiles. Selection is not commodity-equivalent.

Pre-Submission Meetings

For complex devices, pre-submission meetings with the chosen NB are valuable. Typical agenda:

• Device overview and classification rationale
• Regulatory strategy
• Technical file structure preview
• Clinical evaluation strategy
• Open technical questions

Pre-submission meetings are not formal regulatory engagements — NB feedback is non-binding — but they surface scope issues before significant work is invested. The cost of a pre-submission meeting is days; the cost of a misaligned technical file is months.

Review Process

Typical NB review cycle:

1. Application and contract — NB takes the engagement
2. Initial document review — typically 30-60 days for first pass
3. Clarification questions — NB requests for additional information
4. Manufacturer response — typically 30-60 days per response cycle
5. Audit (where applicable) — manufacturing site audit, design review audit
6. CE certificate issuance — once all conformity is demonstrated

Total cycle: 6-18 months for a complete Class IIb-III submission, depending on complexity and NB backlog.

Korean MFDS Cross-Reference

Manufacturers running parallel EU + Korean submissions can leverage the EU technical file work for MFDS submissions, with rebuild for jurisdiction-specific sections. Reusability rates:

Section	EU → Korea reuse rate
Device description, intended use	~90% (translation + Korean indication phrasing review)
Design and manufacturing	~95% (translation only)
Risk management file	~95% (Korean Risk Management Report summary added)
Verification and validation evidence	~95% (translation only)
Clinical evidence	~70% (Korean-relevant validation may be required)
Cybersecurity (for connected devices)	~90% (translation + Korean 2026 framework alignment)
GSPR checklist	~0% (Korean classification and standards reference replace GSPR)
Labeling and IFU	~50% (Korean labeling rules differ; layout and content reused, text adapted)
Notified Body interactions	0% (Korea has no NB equivalent; MFDS direct review)

A unified technical file core — design, manufacturing, V&V, risk, cybersecurity — built once and re-projected into EU and Korean formats is the workable architecture. See Regulatory Foundations for the multi-region technical file architecture.

Common Findings

Patterns we observe in EU MDR / IVDR technical file reviews:

Stale GSPR checklist. Evidence documents have been updated; checklist references point to outdated versions. Mitigation: version-controlled checklist with auto-updating references.

Insufficient clinical evaluation. Class IIa devices increasingly find that historical clinical evidence is insufficient under MDR's stricter clinical evaluation requirements. PMCF plans must address the gap explicitly.

Software documentation gaps. IEC 62304 lifecycle documentation incomplete, particularly for AI/ML or SaMD products where the standard's interpretation is evolving.

Cybersecurity gaps. MDCG 2019-16 cybersecurity expectations exceed what many manufacturers have documented. The cybersecurity packet runs 50-150 pages typically.

Risk management file disconnected from V&V. Risk controls listed but verification evidence references not maintained. See our ISO 14971 Risk Management Integration guide.

Post-market plan inadequate. Annex III PMS plan exists on paper but operational execution is weak. PSUR submissions surface this gap.

Eight Practical Recommendations

1. Build the technical file as structured objects in PLM, not as a folder of documents. Cross-references become live links.

2. Author the GSPR checklist with explicit per-GSPR analysis. Blanket statements get returned.

3. Plan clinical evaluation depth for the MDR class, not the MDD class. Up-classification under MDR rules is common.

4. Engage the Notified Body in pre-submission meetings for complex devices. Worth the time investment.

5. For multi-region operations, build a unified technical file core with EU + Korea + FDA re-projections. The architecture is set once.

6. Maintain the technical file post-clearance. Variants, supplements, updates draw from the same file. A frozen file diverges from production.

7. For IVDR, treat performance evaluation as three pillars — scientific validity, analytical performance, clinical performance. Each pillar requires its own evidence stream.

8. Plan for PSUR submission as part of the Annex III scope. PMS execution is what reviewers eventually check.

Where Leanabl Plugs In

The Submissions service handles EU MDR and IVDR technical file construction, including Notified Body engagement. For organizations running multi-region operations, the unified technical file architecture is set up through Regulatory Foundations. Korean cross-reference and submission work runs through Korea Device Registration and Korea Full Market Authorization.